Procedure examples

NanoCore can modify the victim's anti-virus.

Gold Dragon terminates anti-malware processes if they’re found running on the system.

Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.

TinyZBot can disable Avira anti-virus.

Proton kills security tools like Wireshark that are running.

Mango contains an unused capability to block endpoint security solutions from loading user-mode code hooks via a DLL in a specified process by using the `UpdateProcThreadAttribute API` to set the `PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY` to `PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON` for an identified process.

PHASEJAM has modified Ivanti Connect Secure appliances and blocks the system upgrades by altering the DSUpgrade.pm file.

Clop can uninstall or disable security products.

Egregor has disabled Windows Defender to evade protections.

StealBit can configure processes to not display certain Windows error messages by through use of the `NtSetInformationProcess`.

ZxShell can kill AV products' processes.

SPAWNCHIMERA has modified the Ivanti Integrity Checker Tool to evade detection.

Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.

Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.

ZIPLINE can add itself to the exclusion list for the Ivanti Connect Secure Integrity Checker Tool if the `--exclude` parameter is passed by the `tar` process.

Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.

ChChes can alter the victim's proxy configuration.

Shai-Hulud has replaced DNS configuration from `/tmp/resolved.conf` in order to gain control of network-level control within CI environments and has flushed iptables rules using `sudo iptables -F OUTPUT` and `sudo iptables -F DOCKER-USER`.

JPIN can lower security settings by changing Registry keys.

KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.

Qilin can terminate antivirus-related processes and services.

LazyWiper can disable Microsoft Windows Defender Real-Time Monitoring with the `Set-MpPreference` cmdlet.

Agent Tesla has the capability to kill any running analysis processes and AV software.

POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.

DRYHOOK has killed all instances of the `cgi-server` process in order for the modified Perl module to be activated.

Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.

QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.

SplatCloak has identified and disabled API callback features of Windows Defender and Kaspersky.

Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.

H1N1 kills and disables services for Windows Security Center, and Windows Defender.

WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.

SILENTTRINITY's `amsiPatch.py` module can disable Antimalware Scan Interface (AMSI) functions.

DCRAT can patch Microsoft’s Antimalware Scan Interface (AMSI) to evade detection.

Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).

Imminent Monitor has a feature to disable Windows Task Manager.

Donut can patch Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), as well as exit-related Native API functions to avoid process termination.

Wevtutil can be used to disable specific event logs on the system.

Pacu can disable or otherwise restrict various AWS logging services, such as AWS CloudTrail and VPC flow logs.

PHASEJAM has prevented legitimate Ivanti Connect Secure system upgrades by intercepting the upgrade command and rendering fake HTML upgrade progress bar through a function called `processUpgradeDisplay()` which allowed the compromised device to remain under the control of the adversary.

Ebury disables OpenSSH, system (`systemd`), and audit logs (`/sbin/auditd`) when the backdoor is active.

SynAck clears event logs.

RansomHub can delete events from the Security, System, and Application logs.

Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.

DUSTTRAP can delete infected system log information.

Mafalda can delete Windows Event logs by invoking the `OpenEventLogW` and `ClearEventLogW` functions.

ShrinkLocker calls Wevtutil to clear the Windows PowerShell and Microsoft-Windows-Powershell/Operational logs.

Apostle will attempt to delete all event logs on a victim machine following file wipe activity.

BlackCat can clear Windows event logs using `wevtutil.exe`.

Lucifer can clear and remove event logs.

The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.